Analysis
-
max time kernel
152s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 13:39
Behavioral task
behavioral1
Sample
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe
Resource
win7-20220718-en
General
-
Target
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe
-
Size
337KB
-
MD5
4f8e31356bf04b080c5ba8e47756c50f
-
SHA1
3b5eb07249e213865f1f0f4e779b2db126346c2b
-
SHA256
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
-
SHA512
2c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
Malware Config
Extracted
darkcomet
Guest16
globalgarus.bounceme.net:5552
DC_MUTEX-1A53RNC
-
InstallPath
MSDCSC\testinform.exe
-
gencode
qQc4wjtBrTS4
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
testinform.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile testinform.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" testinform.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" testinform.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
testinform.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" testinform.exe -
Processes:
testinform.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" testinform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" testinform.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
testinform.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" testinform.exe -
Executes dropped EXE 5 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeDesktopLayer.exetestinform.exetestinformSrv.exeDesktopLayer.exepid process 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe 672 DesktopLayer.exe 1232 testinform.exe 1632 testinformSrv.exe 568 DesktopLayer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 304 attrib.exe 1228 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1648-59-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1648-64-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/672-68-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral1/memory/1968-75-0x0000000000400000-0x00000000004D5000-memory.dmp upx C:\Users\Admin\Documents\MSDCSC\testinform.exe upx \Users\Admin\Documents\MSDCSC\testinform.exe upx \Users\Admin\Documents\MSDCSC\testinform.exe upx behavioral1/memory/1632-95-0x0000000000400000-0x0000000000413000-memory.dmp upx C:\Users\Admin\Documents\MSDCSC\testinform.exe upx behavioral1/memory/1232-100-0x0000000000400000-0x00000000004D5000-memory.dmp upx behavioral1/memory/1232-102-0x0000000000400000-0x00000000004D5000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1016 notepad.exe -
Loads dropped DLL 10 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exetestinform.exetestinformSrv.exepid process 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 1232 testinform.exe 1232 testinform.exe 1632 testinformSrv.exe 1632 testinformSrv.exe -
Processes:
testinform.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" testinform.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" testinform.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exetestinform.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\testinform.exe" testinform.exe -
Drops file in Program Files directory 5 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exetestinformSrv.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\px2CF.tmp testinformSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe testinformSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\pxFAA5.tmp 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365561618" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F58D0051-0C7C-11ED-A495-62FF45EB19D5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exeDesktopLayer.exepid process 672 DesktopLayer.exe 672 DesktopLayer.exe 672 DesktopLayer.exe 672 DesktopLayer.exe 568 DesktopLayer.exe 568 DesktopLayer.exe 568 DesktopLayer.exe 568 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
testinform.exepid process 1232 testinform.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exetestinform.exedescription pid process Token: SeIncreaseQuotaPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSecurityPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeTakeOwnershipPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeLoadDriverPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSystemProfilePrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSystemtimePrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeProfSingleProcessPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeIncBasePriorityPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeCreatePagefilePrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeBackupPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeRestorePrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeShutdownPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeDebugPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeSystemEnvironmentPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeChangeNotifyPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeRemoteShutdownPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeUndockPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeManageVolumePrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeImpersonatePrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeCreateGlobalPrivilege 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 33 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 34 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: 35 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe Token: SeIncreaseQuotaPrivilege 1232 testinform.exe Token: SeSecurityPrivilege 1232 testinform.exe Token: SeTakeOwnershipPrivilege 1232 testinform.exe Token: SeLoadDriverPrivilege 1232 testinform.exe Token: SeSystemProfilePrivilege 1232 testinform.exe Token: SeSystemtimePrivilege 1232 testinform.exe Token: SeProfSingleProcessPrivilege 1232 testinform.exe Token: SeIncBasePriorityPrivilege 1232 testinform.exe Token: SeCreatePagefilePrivilege 1232 testinform.exe Token: SeBackupPrivilege 1232 testinform.exe Token: SeRestorePrivilege 1232 testinform.exe Token: SeShutdownPrivilege 1232 testinform.exe Token: SeDebugPrivilege 1232 testinform.exe Token: SeSystemEnvironmentPrivilege 1232 testinform.exe Token: SeChangeNotifyPrivilege 1232 testinform.exe Token: SeRemoteShutdownPrivilege 1232 testinform.exe Token: SeUndockPrivilege 1232 testinform.exe Token: SeManageVolumePrivilege 1232 testinform.exe Token: SeImpersonatePrivilege 1232 testinform.exe Token: SeCreateGlobalPrivilege 1232 testinform.exe Token: 33 1232 testinform.exe Token: 34 1232 testinform.exe Token: 35 1232 testinform.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 780 iexplore.exe 780 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
iexplore.exeIEXPLORE.EXEtestinform.exeIEXPLORE.EXEpid process 780 iexplore.exe 780 iexplore.exe 1180 IEXPLORE.EXE 1180 IEXPLORE.EXE 1232 testinform.exe 780 iexplore.exe 780 iexplore.exe 1096 IEXPLORE.EXE 1096 IEXPLORE.EXE 1096 IEXPLORE.EXE 1096 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeDesktopLayer.exetestinformSrv.exeDesktopLayer.exepid process 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe 672 DesktopLayer.exe 1632 testinformSrv.exe 568 DesktopLayer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeDesktopLayer.execmd.execmd.exeiexplore.exetestinform.exedescription pid process target process PID 1968 wrote to memory of 1648 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 1968 wrote to memory of 1648 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 1968 wrote to memory of 1648 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 1968 wrote to memory of 1648 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe PID 1648 wrote to memory of 672 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 1648 wrote to memory of 672 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 1648 wrote to memory of 672 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 1648 wrote to memory of 672 1648 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe DesktopLayer.exe PID 672 wrote to memory of 780 672 DesktopLayer.exe iexplore.exe PID 672 wrote to memory of 780 672 DesktopLayer.exe iexplore.exe PID 672 wrote to memory of 780 672 DesktopLayer.exe iexplore.exe PID 672 wrote to memory of 780 672 DesktopLayer.exe iexplore.exe PID 1968 wrote to memory of 1828 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 1828 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 1828 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 1828 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 852 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 852 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 852 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1968 wrote to memory of 852 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe cmd.exe PID 1828 wrote to memory of 1228 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 1228 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 1228 1828 cmd.exe attrib.exe PID 1828 wrote to memory of 1228 1828 cmd.exe attrib.exe PID 852 wrote to memory of 304 852 cmd.exe attrib.exe PID 852 wrote to memory of 304 852 cmd.exe attrib.exe PID 852 wrote to memory of 304 852 cmd.exe attrib.exe PID 852 wrote to memory of 304 852 cmd.exe attrib.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 1968 wrote to memory of 1016 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe notepad.exe PID 780 wrote to memory of 1180 780 iexplore.exe IEXPLORE.EXE PID 780 wrote to memory of 1180 780 iexplore.exe IEXPLORE.EXE PID 780 wrote to memory of 1180 780 iexplore.exe IEXPLORE.EXE PID 780 wrote to memory of 1180 780 iexplore.exe IEXPLORE.EXE PID 1968 wrote to memory of 1232 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 1968 wrote to memory of 1232 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 1968 wrote to memory of 1232 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 1968 wrote to memory of 1232 1968 9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe testinform.exe PID 1232 wrote to memory of 1632 1232 testinform.exe testinformSrv.exe PID 1232 wrote to memory of 1632 1232 testinform.exe testinformSrv.exe PID 1232 wrote to memory of 1632 1232 testinform.exe testinformSrv.exe PID 1232 wrote to memory of 1632 1232 testinform.exe testinformSrv.exe PID 1232 wrote to memory of 964 1232 testinform.exe iexplore.exe PID 1232 wrote to memory of 964 1232 testinform.exe iexplore.exe PID 1232 wrote to memory of 964 1232 testinform.exe iexplore.exe PID 1232 wrote to memory of 964 1232 testinform.exe iexplore.exe PID 1232 wrote to memory of 572 1232 testinform.exe explorer.exe PID 1232 wrote to memory of 572 1232 testinform.exe explorer.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
testinform.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" testinform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion testinform.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern testinform.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 304 attrib.exe 1228 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe"C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeC:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:275460 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\testinform.exe"C:\Users\Admin\Documents\MSDCSC\testinform.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
C:\Users\Admin\Documents\MSDCSC\testinformSrv.exeC:\Users\Admin\Documents\MSDCSC\testinformSrv.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4HJASGX7.txtFilesize
608B
MD51cb75d3c341377889795ea4c93a07929
SHA1b8fb6a4211136aa6b77614209f167f5c4836b035
SHA256d3c831f1d1d3fa55106032f8550781729e1ccb78738c1b24e843af34a98c37cf
SHA51235736ab6b43281b2e84f49703cc2055d2a3750b6318912e1115bece206c59dfabdfc16b1a622e166c489469bf27c7c8821c71fe38b443c891cacdc5e887876a0
-
C:\Users\Admin\Documents\MSDCSC\testinform.exeFilesize
337KB
MD54f8e31356bf04b080c5ba8e47756c50f
SHA13b5eb07249e213865f1f0f4e779b2db126346c2b
SHA2569b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
SHA5122c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
-
C:\Users\Admin\Documents\MSDCSC\testinform.exeFilesize
337KB
MD54f8e31356bf04b080c5ba8e47756c50f
SHA13b5eb07249e213865f1f0f4e779b2db126346c2b
SHA2569b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
SHA5122c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
-
C:\Users\Admin\Documents\MSDCSC\testinformSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\Documents\MSDCSC\testinformSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\AppData\Local\Temp\9b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905Srv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\Documents\MSDCSC\testinform.exeFilesize
337KB
MD54f8e31356bf04b080c5ba8e47756c50f
SHA13b5eb07249e213865f1f0f4e779b2db126346c2b
SHA2569b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
SHA5122c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
-
\Users\Admin\Documents\MSDCSC\testinform.exeFilesize
337KB
MD54f8e31356bf04b080c5ba8e47756c50f
SHA13b5eb07249e213865f1f0f4e779b2db126346c2b
SHA2569b82aa17d4bf5cbeb90702eb219fc0c845abfe8a4e00826d67ac60f6129f9905
SHA5122c93d7ffad05bea58635a2445aab9b2a5d050b41c7c940bf74a066b2f4db8e4ecda110c7145a7b7de98904b40f3e8251d9a142cc1aaf4308c653aec26759a71f
-
\Users\Admin\Documents\MSDCSC\testinformSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
\Users\Admin\Documents\MSDCSC\testinformSrv.exeFilesize
52KB
MD517efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
memory/304-72-0x0000000000000000-mapping.dmp
-
memory/568-93-0x0000000000000000-mapping.dmp
-
memory/672-68-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/672-63-0x0000000000000000-mapping.dmp
-
memory/852-70-0x0000000000000000-mapping.dmp
-
memory/1016-73-0x0000000000000000-mapping.dmp
-
memory/1228-71-0x0000000000000000-mapping.dmp
-
memory/1232-79-0x0000000000000000-mapping.dmp
-
memory/1232-101-0x0000000000240000-0x0000000000253000-memory.dmpFilesize
76KB
-
memory/1232-102-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/1232-100-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/1632-95-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1632-84-0x0000000000000000-mapping.dmp
-
memory/1648-57-0x0000000000000000-mapping.dmp
-
memory/1648-64-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1648-59-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/1828-69-0x0000000000000000-mapping.dmp
-
memory/1932-88-0x0000000000000000-mapping.dmp
-
memory/1968-75-0x0000000000400000-0x00000000004D5000-memory.dmpFilesize
852KB
-
memory/1968-99-0x0000000003AC0000-0x0000000003B95000-memory.dmpFilesize
852KB
-
memory/1968-98-0x0000000003AC0000-0x0000000003B95000-memory.dmpFilesize
852KB
-
memory/1968-76-0x00000000001D0000-0x00000000001E3000-memory.dmpFilesize
76KB
-
memory/1968-54-0x0000000075851000-0x0000000075853000-memory.dmpFilesize
8KB